Broken access control in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions 5.12 and earlier) permits unauthenticated remote attackers to invoke privileged plugin actions without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, though impact is bounded to low-severity integrity modification with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at the time of analysis.
Sensitive data exposure in Ultimate Store Kit Elementor Addons (by BDThemes) versions up to and including 3.0.5 permits unauthenticated remote access to restricted system or application data. The vulnerability is reachable over the network with no credentials, no user interaction, and no special configuration, placing every WordPress installation running the affected plugin version at risk of information leakage. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided, but the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) means opportunistic scanning is a realistic threat.
Shiptastic for WooCommerce plugin (versions ≤ 5.1.0) by Vendidero exposes an Insecure Direct Object Reference (IDOR) flaw that allows unauthenticated remote attackers to access shipment or order objects belonging to other users by manipulating predictable reference parameters. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required to trigger the issue, though impact is bounded to low confidentiality disclosure with no integrity or availability consequence. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive data exposure in the Create by Mediavine WordPress plugin (versions <= 2.5.3) allows any remote, unauthenticated user to access information that should be restricted. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no authentication, no user interaction, and low attack complexity, placing all public-facing WordPress sites running an affected version at risk. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low barrier to exploitation makes patching a timely priority.
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers to bypass authorization checks and access restricted content or plugin functionality on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity, unauthenticated network exploitation with a limited confidentiality impact and no data integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the Photography WordPress theme by ThemeGoods (versions ≤ 7.7.6) permits remote unauthenticated attackers to perform unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms trivial network exploitability with low complexity, rooted in CWE-862 (Missing Authorization), where theme logic fails to enforce capability checks before processing sensitive requests. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated broken access control in the Event Post WordPress plugin (versions <= 6.0.1) allows remote attackers without any credentials to bypass authorization checks and access restricted functionality or data. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with no authentication, no user interaction, and low attack complexity, making it trivially scriptable. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated network vector means vulnerable sites can be mass-scanned.
Unauthenticated broken access control in the Content Control WordPress plugin (versions ≤ 2.6.5) allows remote attackers to bypass content restriction rules and retrieve content intended to be hidden from public or lower-privileged users. The plugin, which provides role-based content gating for WordPress sites, fails to enforce authorization in at least one code path, permitting network access without credentials or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality loss with no integrity or availability effects.
Broken access control in the Civi WordPress theme (by uxper) versions up to and including 2.2.4 permits unauthenticated remote attackers to perform restricted actions that should require authorization. The vulnerability stems from missing authorization checks (CWE-862), allowing network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to abuse against any unpatched installation.
Unauthenticated sensitive data exposure in the Ninja Tables WordPress plugin (versions ≤ 5.2.10) allows remote unauthenticated attackers to retrieve sensitive information without any credentials or user interaction. The flaw, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), is accessible over the network with low complexity, making it trivially exploitable against any WordPress site running an affected version of the plugin. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequences.
Unauthenticated broken access control in the Kit (formerly ConvertKit) WordPress plugin versions up to and including 3.3.5 allows network-accessible attackers to perform restricted actions without any credentials. Rooted in CWE-862 (Missing Authorization), the plugin fails to verify whether a requestor is authorized before executing sensitive operations, resulting in limited but real integrity impact on affected WordPress installations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken Access Control in AWP Classifieds (Another WordPress Classifieds Plugin) version 4.4.7 and earlier permits unauthenticated remote attackers to perform unauthorized actions against the plugin's content management functions, resulting in limited integrity compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication is required and the attack is trivially executable over the network with no user interaction, though impact is bounded to integrity only with no confidentiality or availability loss. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Broken access control in the JetBooking WordPress plugin (versions ≤ 4.1.2) exposes unauthenticated attackers to unauthorized write operations against booking data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point on a publicly reachable WordPress endpoint warrants prompt patching for any internet-facing deployment.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) exposes restricted plugin functionality to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no credentials and no user interaction, with the impact limited to unauthorized integrity modifications - no data disclosure or availability impact is indicated. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) permits unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data. The flaw stems from missing capability verification (CWE-862) on one or more plugin endpoints, allowing any internet-accessible WordPress installation running this plugin to leak limited confidential information without credentials. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded by a low confidentiality rating with no integrity or availability consequence.
Unauthenticated broken access control in ShopLentor Pro (WordPress plugin by WooLentor) versions 2.8.5 and earlier permits remote attackers without any credentials to bypass authorization controls and perform unauthorized data-modification actions against affected WooCommerce stores. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and low attack complexity against default plugin installations. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated arbitrary file deletion in the Broadcast Live Video WordPress plugin (versions <= 7.2.4) allows any remote attacker without credentials to delete arbitrary files on the server by exploiting a path traversal flaw in the plugin's file-handling functionality. Affecting installations of the VideoWhisper live streaming plugin on WordPress, a successful attack can corrupt site integrity - including deletion of critical files such as wp-config.php, effectively bricking the WordPress installation. No public exploit code or KEV listing has been identified at time of analysis, but the zero-authentication barrier lowers the practical difficulty considerably.
Broken access control in the YT Player WordPress plugin (versions <= 2.0.9) permits unauthenticated remote attackers to invoke restricted plugin actions without any authorization check. The flaw, rooted in a missing authorization gate (CWE-862), allows network-accessible exploitation with no user interaction required, resulting in unauthorized modification of plugin-controlled data or settings (CVSS 5.3 Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken access control in WP Fast Total Search WordPress plugin (versions <= 1.81.282, by Epsiloncool) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The flaw stems from missing authorization checks (CWE-862), meaning one or more plugin endpoints or AJAX actions fail to verify caller identity or capability before executing. Real-world impact is limited to low integrity compromise with no confidentiality or availability loss, but the unauthenticated, low-complexity nature makes it trivially exploitable against any vulnerable WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in MarketKing (WooCommerce multivendor marketplace plugin) version 2.1.40 and earlier allows unauthenticated remote attackers to perform unauthorized marketplace actions without valid credentials. The flaw stems from missing authorization checks (CWE-862), enabling integrity-impacting operations against affected WordPress/WooCommerce installations. No public exploit code or active exploitation has been identified at time of analysis, and the impact is constrained to integrity (I:L), with no confidentiality or availability consequences.
Broken access control in the Ditty WordPress plugin (all versions through 3.1.66) permits unauthenticated remote attackers to invoke restricted plugin functionality without any credentials, yielding limited availability impact on affected WordPress sites. Reported by Patchstack and confirmed via NVD with CVSS 5.3 (Medium), the flaw stems from CWE-862 Missing Authorization - a failure to verify caller permissions before executing protected actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this accessible once the specific unprotected endpoint is known.
Broken access control in WP Go Maps WordPress plugin versions 10.1.04 and earlier allows unauthenticated remote attackers to access restricted resources without authorization. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling network-accessible exploitation with no credentials required. Impact is limited to a partial confidentiality breach - no data modification or availability impact - but the zero-barrier entry point makes it trivially reachable by automated scanners. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Open redirect in React Router (npm package, versions 6.0.0 through 7.17.x) allows bypass of the prior CVE-2025-68470 patch via attacker-supplied paths containing mixed backslash and forward-slash sequences (e.g., \\evil.com, /\evil.com, \/evil.com) passed to navigation APIs including useNavigate() and the Link component. Browsers interpret these malformed protocol-relative URL patterns as pointing to external hosts, enabling unexpected external navigation. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; vendor-released patch v7.18.0 is available.
DOMPurify versions up to and including 3.3.3 incorrectly resolves a tag-allow conflict when ADD_TAGS is used in its function form alongside FORBID_TAGS, causing forbidden tags to survive sanitization. The flaw is a short-circuit evaluation error in purify.ts (lines 1117-1123): when the ADD_TAGS callback (tagCheck) returns true for a tag, the Boolean AND short-circuits, meaning FORBID_TAGS is never consulted - directly contradicting the attribute-side behavior where FORBID_ATTR always wins. An attacker who can supply HTML to an application using this specific configuration can inject tags the developer explicitly intended to block, leading to XSS or related injection in whatever context the sanitized output is rendered. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
DOMPurify through 3.3.3 leaks function predicate state across sanitize() calls on the same instance, enabling XSS bypass when applications invoke the library with mixed parameter types for ADD_ATTR or ADD_TAGS. Specifically, a function predicate supplied to one sanitize() call persists in the internal EXTRA_ELEMENT_HANDLING map and is not evicted when a subsequent call on the same instance supplies ADD_ATTR or ADD_TAGS as a plain array, allowing attacker-controlled event-handler attributes or vendor-forbidden tags to survive sanitization. No public exploit or CISA KEV listing is confirmed at time of analysis; the CVSS 4.0 score of 5.1 reflects user interaction required and impact scoped to the subsequent system (browser context), consistent with a reflected or stored XSS consequence.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious scripts via the proxy server address field in the Call Home configuration wizard. The `CallHomeSettingsWizard.SaveAllConfigSettings()` method stores the attacker-supplied input without output encoding, and the payload subsequently executes in the browsers of any user who visits the General Settings Additional Settings page - including administrators, whose sessions could be harvested. No public exploit or CISA KEV listing is identified at time of analysis, but the stored nature of the XSS elevates impact beyond a reflected variant by enabling broad victim targeting post-injection.
Reflected XSS in the Phoca Guestbook Joomla extension (versions 1.0.0 through 6.1.0) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser via crafted, unsanitized URL parameters or form inputs reflected back by the extension without proper encoding. Exploitation requires the victim to click a specially crafted link (UI:A per CVSS 4.0), making phishing or social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Reflected XSS in Phoca Maps 1.0.0 through 6.0.9, a Joomla mapping extension by phoca.cz, allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL containing unsanitized input. The vulnerability stems from improper validation of user-supplied input that is reflected back into the HTTP response without adequate output encoding (CWE-79). No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects moderate impact limited by the mandatory active user interaction requirement.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web script via the scheduled report name field in the MailInsights module. The injected payload is persisted by the server-side handler ReportScheduling.btnSaveReport_Click() without output encoding and fires only in the browser of the user who created the report, making this effectively a self-XSS - significantly constraining real-world impact unless the stored report name is also rendered in other authenticated users' sessions. No public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary JavaScript in the Archive Assistant default import settings by injecting through the configured folders parameter at /Archiver/ImportSettingsWizard.ashx. The payload survives server-side because SaveAllConfigSettings() writes it to storage without output encoding, then executes in the browser of any subsequent user who views the import settings page - including potentially higher-privileged administrators. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the authenticated entry requirement and the downstream scope change to other users' browser sessions.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persistent JavaScript into the File Archive Assistant configuration page via the excluded extensions parameter. The payload is stored server-side by `FileArchiveAssistantWizard.btnSave_Click()` without output encoding and executes in the browser of any user who subsequently views the File Archive Assistant settings page - typically an administrator. No public exploit identified at time of analysis and no CISA KEV listing; real-world impact is limited to browser-session-level attacks against users who access the specific settings page.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject persistent JavaScript into the SMTP server address field of the General Settings wizard, which subsequently executes in the browsers of any user who views that settings page. The flaw resides in the server-side method GeneralSettingsWizard.SaveAllConfigSettings(), which persists the SMTP address parameter without output encoding, enabling payload storage and deferred execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and the likelihood that administrators frequently access General Settings elevates practical risk beyond the moderate CVSS 4.0 score of 5.1.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently inject arbitrary JavaScript or HTML via the server URL parameter on the IMAP Server configuration wizard at /Archiver/ImapServerWizard.aspx. The payload is written to persistent storage by ImapServerWizard.SaveAllConfigSettings() without output encoding, and executes in the browser of any user - typically an administrator - who subsequently navigates to the IMAP Server configuration page. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV.
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to inject persistent JavaScript payloads via the policy name field of the File History Retention Policy wizard. The injected payload is written to storage by `RetentionPolicyWizard.SaveAllConfigSettings()` without output encoding and subsequently executes in the browser of any user — including higher-privileged administrators — who views the File History Retention Policies page. No public exploit or active exploitation has been identified; the CVSS 4.0 score of 5.1 reflects the passive user-interaction dependency that limits immediate attacker control.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbitrary script via the Retention Policy name field at /Archiver/RetentionPolicyWizard.aspx, with the payload persisting through SaveAllConfigSettings() and executing against any user who subsequently views the Retention and Spam Policies page. The CVSS 4.0 score of 5.1 reflects network-accessible reach offset by required authentication and passive victim interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, suggesting this has not yet seen active widespread exploitation.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persistent malicious scripts via the Classification Rules configuration, specifically the rule name and email criteria fields in CategorizationPolicyWizard.aspx. The injected payload is written to the backend by SaveAllConfigSettings() without any output encoding, causing it to execute in the browsers of every subsequent user who views the Classification Rules page - including administrators. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
Server-Side Request Forgery in JetEngine WordPress plugin versions up to and including 3.8.11 allows authenticated Contributors to induce the server to make outbound HTTP requests to attacker-controlled destinations, including internal network resources. The vulnerability carries a scope change (S:C in CVSS), meaning exploitation can reach systems beyond the WordPress host itself - such as cloud metadata endpoints or internal services. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level entry bar and network attack vector make this a realistic insider or low-privilege post-authentication risk.
Server-Side Request Forgery in the JetBooking WordPress plugin (versions up to and including 4.1.2) allows authenticated low-privilege users to force the server to issue arbitrary HTTP requests via the custom role functionality. With a scope-changed CVSS vector (S:C), successful exploitation can expose internal network resources and services not ordinarily reachable from the public internet, yielding limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at the time of analysis.
Broken access control in the Qubely WordPress Gutenberg block plugin (versions up to and including 1.8.14) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in limited confidentiality and integrity compromise. The vulnerability stems from missing authorization enforcement (CWE-862) on one or more plugin endpoints exposed to the network. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector reflects high attack complexity, tempering real-world risk below what the unauthenticated access vector alone might suggest.
Directory traversal in the WP Encryption WordPress plugin (all versions through 7.8.6.6) allows authenticated administrators to read arbitrary server files via the unsanitized 'imploded' parameter in le_admin.php, potentially exposing credentials, API keys, and configuration secrets. Beyond file-read access, the plugin's write path sanitizes output only through esc_html() - which blocks PHP tag execution but leaves plaintext files such as .htaccess fully writable, opening a secondary path to denial-of-service or malicious redirect injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Wordfence has published an upstream changeset suggesting remediation is in progress.
Stored cross-site scripting in the BeRocket Brands for WooCommerce WordPress plugin (all versions through 3.8.8) enables authenticated Shop Manager-level users to inject persistent JavaScript via the br_brand_tooltip term meta field, executing against any visitor who loads an affected page. A notable architectural bypass is central to this flaw: because the payload is stored in WordPress term meta rather than post content, the platform's unfiltered_html capability gate - which normally prevents Shop Managers from injecting raw HTML - does not apply, granting that role unexpectedly full exploitation capability. No public exploit code and no CISA KEV listing exist at time of analysis.
Server-Side Request Forgery in the Complianz WordPress GDPR compliance plugin (versions 7.5.0 and below) allows authenticated attackers with Author-level privileges or higher to forge requests from the server, enabling internal network probing and limited confidentiality and integrity impact. The Scope:Changed CVSS metric confirms the vulnerability crosses the server's trust boundary, a characteristic consistent with SSRF enabling access to internal resources unreachable by the attacker directly. No public exploit code has been identified at time of analysis, and the high privilege requirement (PR:H) substantially limits opportunistic exploitation.
Server-Side Request Forgery in the Photo Block WordPress plugin (versions 1.7.1 and earlier) allows authenticated administrators to cause the hosting WordPress server to issue arbitrary HTTP requests to attacker-controlled destinations, including internal network services. The CVSS scope-change flag (S:C) indicates impact extends beyond WordPress itself to back-end infrastructure reachable from the server. No public exploit code and no CISA KEV listing exist at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool to compromised admin accounts or rogue administrators.
Sensitive data exposure in Polylang WordPress plugin (versions <= 3.8.5) allows authenticated Contributors to access information beyond their authorization scope. The vulnerability, classified under CWE-497, enables low-privileged authenticated users - specifically those holding the WordPress Contributor role - to read sensitive data they should not be permitted to view. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Unthrottled resource allocation in BizimHesap Online Pre-Accounting Software allows authenticated low-privileged network attackers to exhaust system resources, causing a denial of service condition. All versions through 17072026 are confirmed affected. Reported by Turkey's National Cyber Incident Response Center (USOM), no public exploit code or active exploitation has been identified at time of analysis. The vulnerability carries a CVSS 4.3 score, reflecting a low-availability-impact DoS limited to authenticated users.
Broken access control in Cyr to Lat Reloaded (WordPress plugin by Themeisle) allows low-privileged authenticated users at the subscriber role to invoke restricted plugin actions on affected WordPress installations running version 1.3.3 and below. The flaw stems from missing authorization checks (CWE-862), permitting subscribers to perform operations intended for higher-privileged users such as editors or administrators. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility via standard WordPress HTTP endpoints make it straightforward to abuse given subscriber-level access.
Sensitive data exposure in the TinyMCE Templates WordPress plugin (versions <= 4.8.1) allows authenticated users holding the Contributor role to access information beyond their authorization boundary. The flaw is classified under CWE-497, indicating that system or application internals are being surfaced to an unauthorized control sphere - in this case, low-privileged WordPress users. No active exploitation or public proof-of-concept has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the limited scope: confidentiality-only impact with no integrity or availability consequences.
TemplateSpare WordPress plugin versions up to and including 4.2.2 exposes restricted functionality to subscriber-level authenticated users via a Broken Access Control flaw (CWE-862: Missing Authorization). Authenticated users holding the WordPress subscriber role - the lowest privilege tier - can bypass intended authorization gates and read data or invoke actions not intended for their role. No public exploit code and no CISA KEV listing are present at time of analysis, but the low attack complexity and network accessibility make this a realistic threat on sites that permit open registration or have untrusted subscriber accounts.
Broken Access Control in the Avada Custom Branding WordPress plugin (versions <= 1.2) allows authenticated users with contributor-level roles to access functionality or data restricted to higher-privileged roles, resulting in unauthorized information disclosure. The CVSS vector confirms network-exploitable, low-privilege exploitation with a limited confidentiality impact (C:L) and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis, keeping real-world risk constrained despite the medium CVSS score.